Become a Member

Regulation TrackerLaws, orders and treaties read for their security duties and clocks Standards & FrameworksAttack taxonomies, control catalogues and frontier frameworks AI Incident DatabaseThe security incident record, with mechanism and lesson Research Paper LibraryThe papers that define the field, summarised OSS DirectoryRed teaming, guardrail, supply chain and evaluation tools Case StudiesProgrammes built, with measured outcomes AI Vulnerability TrackerCVEs and advisories for the components AI systems are built from

Latest in the tracker

New York Stop Addictive Feeds Exploitation (SAFE) for Kids Act and implementing rulesNew York's law restricting algorithmic feeds for minors takes effect on 25 January 2027 under final rules published in July 2026, with certified age assurance and $5,000-per-violation penalties.

Knowledge Base Regulation Tracker Standards & Frameworks OSS Directory AI Incident Database Research Paper Library Case Studies Society Articles News Jobs About Charter Become a Member

Home/AI Incident Database/"ShadowRay": unauthenticated Ray clusters exploited for months to steal credentials and mine cryptocurrency (CVE-2023-48022)

"ShadowRay": unauthenticated Ray clusters exploited for months to steal credentials and mine cryptocurrency (CVE-2023-48022)

Oligo found that attackers had been using a disputed Ray vulnerability since late 2023 to run code on exposed AI clusters, stealing cloud credentials, API keys and production model access and installing cryptominers.

Severity: Highrayshadowraycve-2023-48022ai infrastructure

At a glance

Organisation: Anyscale (Ray); Oligo Security
Industry: Cloud and infrastructure
Country or region: Global
Occurred: 5 Sept 2023
Discovered: 1 Feb 2024
Disclosed: 26 Mar 2024

All details 15

Type of harm: Unauthorised access or account takeover, Credential and secret exposure, Resource theft and cost abuse, Model or data tampering
Kind of system: ML pipelines and development tooling
Severity: High
Confirmation: Confirmed by the organisation
Tools involved: Ray Jobs API, Ray dashboard
Technique: Exploitation of an unauthenticated jobs API exposed to the internet (AML.T0012 valid accounts / T0040 ML model inference API access)
Primary root cause: Misconfiguration or exposed service
Scale: Hundreds of exposed clusters including at large companies; OpenAI, Hugging Face and database tokens stolen
Outcome: Anyscale disputed the CVE as intended behaviour outside a trusted network and later added authentication options; the campaign is the first documented large-scale attack on AI compute infrastructure.

Sources

oligo.securityhttps://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-…

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Submit incident Report a correction or request removal